ali2woo-lite / includes / libs / json_api / controllers / auth.php

auth.php in AliNext – WooCommerce Dropshipping Plugin for AliExpress trunk, at includes/libs/json_api/controllers/auth.php

141 lines 5.9 KB

Raw Download Zip

1	<?php
2	// phpcs:ignoreFile WordPress.Security.NonceVerification.Recommended
3	namespace AliNext_Lite;;
4
5	/*
6	Controller Name: Auth
7	Controller Description: Authentication add-on controller for the Wordpress JSON API plugin
8	Controller Author: Matt Berg, Ali Qureshi
9	Controller Author Twitter: @parorrey
10	*/
11
12	class JSON_API_Auth_Controller {
13
14	public function __construct() {
15	global $a2wl_json_api;
16	// allow only connection over https. because, well, you care about your passwords and sniffing.
17	// turn this sanity-check off if you feel safe inside your localhost or intranet.
18	// send an extra POST parameter: insecure=cool
19	if (empty($_SERVER['HTTPS']) \|\| (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'off')) {
20	if (empty($_REQUEST['insecure']) \|\| $_REQUEST['insecure'] != 'cool') {
21	//$a2wl_json_api->error("I'm sorry Dave. I'm afraid I can't do that. (use _https_ please)");
22	}
23	}
24	$allowed_from_post = array('cookie', 'username', 'password', 'seconds', 'nonce');
25	foreach ($allowed_from_post as $param) {
26	if (isset($_POST[$param])) {
27	$a2wl_json_api->query->$param = $_POST[$param];
28	}
29	}
30	}
31
32	public function permissions($method){
33	global $a2wl_json_api;
34	$protected_methods = array('validate_auth');
35	if(in_array($method, $protected_methods)){
36	$a2wl_key = $a2wl_json_api->query->get('a2w-key');
37	if(!empty($a2wl_key)){
38	// new auth method
39	return $a2wl_json_api->query->is_valid_api_key($a2wl_key);
40	}else{
41	// old auth method
42	if ($a2wl_json_api->query->cookie && wp_validate_auth_cookie($a2wl_json_api->query->cookie, 'logged_in')) {
43	return true;
44	}
45	return false;
46	}
47	}
48	return true;
49	}
50
51	public function validate_auth() {
52	return array("valid" => true );
53	}
54
55	public function validate_auth_cookie() {
56	if (!$a2wl_json_api->query->cookie) {
57	$a2wl_json_api->error("You must include a 'cookie' authentication cookie. Use the `create_auth_cookie` Auth API method.");
58	}
59	$valid = wp_validate_auth_cookie($a2wl_json_api->query->cookie, 'logged_in') ? true : false;
60	return array(
61	"valid" => $valid
62	);
63	}
64
65	public function generate_auth_cookie() {
66	global $a2wl_json_api;
67	if (!$a2wl_json_api->query->username) {
68	$a2wl_json_api->error("You must include a 'username' var in your request.");
69	}
70	if (!$a2wl_json_api->query->password) {
71	$a2wl_json_api->error("You must include a 'password' var in your request.");
72	}
73	if ($a2wl_json_api->query->seconds)
74	$seconds = (int) $a2wl_json_api->query->seconds;
75	else
76	$seconds = 1209600; //14 days
77	$user = wp_authenticate($a2wl_json_api->query->username, $a2wl_json_api->query->password);
78	if (is_wp_error($user)) {
79	$error_messages = array();
80	foreach($user->get_error_codes() as $error_code){
81	$error_messages[] = $user->get_error_message($error_code);
82	}
83	$a2wl_json_api->error($error_messages?implode(' # ',$error_messages):"Invalid username and/or password.", 'error', '401');
84	remove_action('wp_login_failed', $a2wl_json_api->query->username);
85	}
86	$expiration = time() + apply_filters('auth_cookie_expiration', $seconds, $user->ID, true);
87	$cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in');
88	preg_match('\|src="(.+?)"\|', get_avatar($user->ID, 32), $avatar);
89	return array(
90	"cookie" => $cookie,
91	"cookie_name" => LOGGED_IN_COOKIE,
92	"user" => array(
93	"id" => $user->ID,
94	"username" => $user->user_login,
95	"nicename" => $user->user_nicename,
96	"email" => $user->user_email,
97	"url" => $user->user_url,
98	"registered" => $user->user_registered,
99	"displayname" => $user->display_name,
100	"firstname" => $user->user_firstname,
101	"lastname" => $user->last_name,
102	"nickname" => $user->nickname,
103	"description" => $user->user_description,
104	"capabilities" => $user->wp_capabilities,
105	"avatar" => $avatar[1]
106	),
107	);
108	}
109
110	public function get_currentuserinfo() {
111	global $a2wl_json_api;
112	if (!$a2wl_json_api->query->cookie) {
113	$a2wl_json_api->error("You must include a 'cookie' var in your request. Use the `generate_auth_cookie` Auth API method.");
114	}
115	$user_id = wp_validate_auth_cookie($a2wl_json_api->query->cookie, 'logged_in');
116	if (!$user_id) {
117	$a2wl_json_api->error("Invalid authentication cookie. Use the `generate_auth_cookie` Auth API method.");
118	}
119	$user = get_userdata($user_id);
120	preg_match('\|src="(.+?)"\|', get_avatar($user->ID, 32), $avatar);
121	return array(
122	"user" => array(
123	"id" => $user->ID,
124	"username" => $user->user_login,
125	"nicename" => $user->user_nicename,
126	"email" => $user->user_email,
127	"url" => $user->user_url,
128	"registered" => $user->user_registered,
129	"displayname" => $user->display_name,
130	"firstname" => $user->user_firstname,
131	"lastname" => $user->last_name,
132	"nickname" => $user->nickname,
133	"description" => $user->user_description,
134	"capabilities" => $user->wp_capabilities,
135	"avatar" => $avatar[1]
136	)
137	);
138	}
139
140	}
141